27 September 2006

OpenSSH 4.4

* Implemented conditional configuration in sshd_config(5) using the
“Match” directive. This allows some configuration options to be
selectively overridden if specific criteria (based on user, group,
hostname and/or address) are met. So far a useful subset of post-
authentication options are supported and more are expected to be
added in future releases.

* Add support for Diffie-Hellman group exchange key agreement with a
final hash of SHA256.

* Added a “ForceCommand” directive to sshd_config(5). Similar to the
command=”…” option accepted in ~/.ssh/authorized_keys, this forces
the execution of the specified command regardless of what the user
requested. This is very useful in conjunction with the new “Match”
option.

* Add a “PermitOpen” directive to sshd_config(5). This mirrors the
permitopen=”…” authorized_keys option, allowing fine-grained
control over the port-forwardings that a user is allowed to
establish.

* Add optional logging of transactions to sftp-server(8).

* ssh(1) will now record port numbers for hosts stored in
~/.ssh/authorized_keys when a non-standard port has been requested.

* Add an “ExitOnForwardFailure” option to cause ssh(1) to exit (with
a non-zero exit code) when requested port forwardings could not be
established.

* Replacement of all integer overflow susceptible invocations of
malloc(3) and realloc(3) with overflow-checking equivalents.

* Many manpage fixes and improvements

* New portable OpenSSH-specific features:

– Add optional support for SELinux, controlled using the
–with-selinux configure option (experimental)

– Add optional support for Solaris process contracts, enabled
using the –with-solaris-contracts configure option (experimental)
This option will also include SMF metadata in Solaris packages
built using the “make package” target